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WHAT IS CLAIMED 

1 . A method of detecting network-intrusions at a first node of a network, 
comprising: 

identifying a firame as an intrusion by an intrusion detection application; 
archiving event-data associated with the frame; and 

decoding the event-data by a decode engine, the decode engine integrated 
within the intrusion detection appUcation. 

2. The method according to claim 1, further comprising providing, by a 
network filter service provider of the intrusion detection appUcation, the event-data to 
an event-database. 

3. The method according to claim 2, further comprising providing the 
event-data to a decode server. 

4. The method according to claim 3, wherein the decode server obtains 
the event-data from at least one of an event viewer and a report server. 

5. The method according to claim 1 , further comprising: 
generating a report from the decoded event-data; and 
providing the report to a report viewer. 

6. The method according to claim 1, further comprising providing, by the 
intrusion detection application, the decoded event-data to an intrusion detection client 
application, 

7. The method according to claim 6, wherein the decoded event-data is 
formatted, by the client application, for display in a graphical user interface. 

8. The method according to claim 6, wherein the intrusion detection 
application runs locally on the first node. 
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9. The method according to claim 6, wherein the intrusion detection client 
application runs remotely on a second node, the first node and the second node 
operable to engage in a communication session between the cUent application and the 
intrusion detection application. 

10. A computer-readable medium having stored thereon a set of 
instructions to be executed, the set of instructions, when executed by a processor, 
cause the processor to perform a computer method of: 

identifying, by an intrusion detection application, a Iframe of data as intrusion- 
related; and 

decoding the intrusion-related data. 

11. The computer-readable medium according to claim 10, wherein the 
instruction set, when executed by the processor, further causes the processor to 
perform the computer method of generating a report fi-om the decoded intrusion- 
related data. 

12. The computer-readable medium according to claim 10, wherein the 
instruction set, when executed by the processor, further causes the processor to 
perform the computer method of archiving the decoded intrusion-related data in a 
database. 

13. The computer-readable medium according to claim 10, wherein the 
instruction set, when executed by the processor, further causes the processor to 
perform the computer method of archiving the identified data in a database. 

14. The computer-readable medium according to claim 11, wherein the 
instruction set, when executed by the processor, further causes the processor to 
perform the computer method of transmitting the decoded data to a client application. 
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15. The computer-readable medium according to claim 14, wherein 
transmitting the decoded data to a client application further comprises transmitting the 
report to a client application in communication with the intrusion detection 
application. 

16. The computer readable medium according to claim 15, wherein 
transmitting the report to a client application ftirther comprises transmitting the report 
to the cUent application in communication with the intrusion detection apphcation, the 
client application running remotely from the intrusion detection application. 



